#!/bin/bash
PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:~/bin
export PATH
#Current folder
CUR_DIR=`pwd`

for i in `ps x|grep yum|grep -v grep|awk '{print $1}'`;do 
		kill -9 $i
	done

# 确认使用root用户运行脚本 顺序1
function rootness(){
    if [[ $EUID -ne 0 ]]; then
		echo "Error:This script must be run as root!" 1>&2
		exit 1
    fi
}

# 通用-设置DNS,检查centos系统版本并优化yum源.目前支持centos5和centos6  顺序2
function chksystem(){
	echo nameserver 180.76.76.76 >/etc/resolv.conf
	VERSION=$(cat /etc/redhat-release |awk '{print $3}'|awk -F "." '{print $1}')
    if [[ $VERSION = 5 ]] || [[ $VERSION = 6 ]]; then
		rm /etc/yum.repos.d/* -rf
		curl -s http://mirrors.aliyun.com/repo/Centos-$VERSION.repo >/etc/yum.repos.d/CentOS-Base.repo
		yum clean all
		yum makecache
	else
		echo "Error:This script must be run on Centos-5 or Centos-6!" 1>&2
		exit 1
	fi
}

# 通用-关闭并禁用selinux 顺序3
function disable_selinux(){
	if [ -s /etc/selinux/config ] && grep 'SELINUX=enforcing' /etc/selinux/config; then
		sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config
		setenforce 0
	fi
}

# 通用-关闭并禁用iptables和其他无用服务 顺序4
function disable_services(){
	chkconfig iptables off
	service iptables stop
	chkconfig ip6tables off
	service ip6tables stop
	chkconfig netfs off
	service netfs stop
}

# 通用-关闭重启ctl-alt-delete组合键 顺序5
function disable_ctl_alt_delete(){
	if [ -s /etc/init/control-alt-delete.conf ] && grep "exec /sbin/shutdown -r now" /etc/init/control-alt-delete.conf >/dev/null; then
		sed -i '/exec \/sbin\/shutdown -r now/d' /etc/init/control-alt-delete.conf
	fi
}

# 通用-优化sshd服务 顺序6
function refinement_ssh(){
	sed -i "s/#UseDNS yes/UseDNS no/"  /etc/ssh/sshd_config
	sed -i "s/GSSAPIAuthentication yes/GSSAPIAuthentication no/"  /etc/ssh/sshd_config
	service sshd restart >/dev/null
}

# 通用-优化最大并发和会话数限制 顺序7
function refinement_limits(){
	sed -i '/ulimit -n/d' /etc/profile
	sed -i '/soft nofile/d' /etc/security/limits.conf
	sed -i '/hard nproc/d' /etc/security/limits.conf
	sed -i '/hard nofile/d' /etc/security/limits.conf
	sed -i '/soft nproc/d' /etc/security/limits.conf
	echo -e "* soft nofile 65535">>/etc/security/limits.conf
	echo -e "* hard nofile 65535">>/etc/security/limits.conf
	echo -e "* soft nproc 65535">>/etc/security/limits.conf
	echo -e "* hard nproc 65535">>/etc/security/limits.conf

	if [ -s /etc/pam.d/login ] && grep "session required pam_limits.so" /etc/pam.d/login >/dev/null;then
		:
	else
		echo -e "session required pam_limits.so">>/etc/pam.d/login
	fi
	
	# CONNTRACK_COUNT=$(find /proc/sys/net/netfilter/*conntrack_count)
	# cat $CONNTRACK_COUNT
	# CONNTRACK_MAX=$(find /proc/sys/net/netfilter/*conntrack_max)
	# echo 102400 >$CONNTRACK_MAX
	# CONNTRACK_TCP_TIMEOUT_ESTABLISHED=$(find /proc/sys/net/netfilter/*conntrack_tcp_timeout_established)
	# echo 21600 >$CONNTRACK_TCP_TIMEOUT_ESTABLISHED
}

# 通用-同步系统时间 顺序8 需调整。5和6安装的内容不一样。。5安装ntp 6安装ntpdate
function refinement_ntp_localtime(){
	\cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
	yum -y install ntp ntpdate
	ntpdate time.windows.com >/dev/null
	hwclock -w
	if [ -s /etc/crontab ] && grep "ntpdate" /etc/crontab; then
		sed -i '/ntpdate/d' /etc/crontab
	fi
	echo "0 * * * * /usr/sbin/ntpdate time.windows.com;hwclock -w">>/etc/crontab
}

# 通用-安装snmp服务并配置启用 顺序9
function install_snmpd(){
	if service snmpd status>/dev/null;then
	service snmpd status
	else
	yum -y install net-snmp
	rm -f /etc/snmp/snmpd.conf
cat>>/etc/snmp/snmpd.conf<<EOF
com2sec notConfigUser default cncidc
group notConfigGroup v2c notConfigUser
view all included .1 80
view systemview included .1.3.6.1.2.1.1
view systemview included .1.3.6.1.2.1.25.1.1
access notConfigGroup "" any noauth exact all none none
syslocation Tizone
syscontact Jack(efengs@126.com)
disk / 10000
load 12 14 14
EOF
	chkconfig snmpd on
	service snmpd start
	fi
}


# 通用-开始优化 顺序0
function start_all(){
	rootness
	chksystem
	disable_selinux
	disable_services
	disable_ctl_alt_delete
	refinement_ssh
	refinement_limits
	refinement_ntp_localtime
	install_snmpd
}

# 通用-启动参数
action=$1
[  -z $1 ] && action=start
case "$action" in
start)
    start_all
    ;;
*)
    echo "Usage: `basename $0` {start}"
	echo ""
	echo "To start use start"
    ;;
esac
